CVE-2026-52743

Executive Summary

CVE-2026-52743 is an authorization bypass vulnerability in GoCD, a continuous delivery server, affecting versions prior to 26.1.0. The internal /jobStatus.json API fails to validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user with low privileges can enumerate job IDs to retrieve status information for jobs in pipelines they are not authorized to view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. While the vulnerability does not expose console output, artifacts, commands, variables, or configuration, the leaked metadata can facilitate further reconnaissance and lateral movement within the CI/CD environment. The CVSS score is 4.3 (Medium), reflecting a low confidentiality impact with no impact on integrity or availability.

Technical Analysis

GoCD is a continuous delivery server used to model complex CD pipelines. The vulnerability resides in the internal UI API endpoint /jobStatus.json, which is designed to return the status of a specific job identified by a server-assigned job ID. The endpoint takes parameters that include a pipeline name and a stage name, presumably to contextualize the job. However, the implementation fails to verify that the supplied job ID actually belongs to the pipeline and stage specified in the request. This is a classic case of CWE-639: Authorization Bypass Through User-Controlled Key.

In a properly secured system, the application should enforce that the authenticated user has permission to view the pipeline and stage associated with the requested job ID. Because the server-assigned job ID is a predictable or enumerable identifier, an attacker with any authenticated account can iterate over possible job IDs, supply arbitrary pipeline and stage names (or perhaps the correct ones if known), and receive status data for jobs that belong to other pipelines or stages. The response includes job names, state (e.g., scheduled, running, completed), progress timestamps, assigned agent IP addresses and UUIDs, and the associated stages and pipelines. This information is not sensitive enough to include console output, artifacts, commands, variables, or configuration, but it still reveals internal infrastructure details and pipeline topology.

The attack surface is the GoCD web UI, which is typically exposed on port 8153 (HTTP) or 8154 (HTTPS). The vulnerability requires authentication (PR:L) and network access (AV:N), with no user interaction (UI:N) and no special conditions (AC:L). The scope is unchanged (S:U), and the impact is limited to confidentiality (C:L) with no integrity or availability impact.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/Target Identification: The attacker identifies a GoCD instance, typically via Shodan or by targeting known internal CI/CD servers. They must possess valid credentials for any user account, even a low-privileged one.

2. Triggering the Flaw: The attacker sends authenticated HTTP requests to the /jobStatus.json endpoint. They supply a job ID (which may be enumerated or guessed) along with pipeline and stage names. Because the server does not validate that the job ID belongs to the specified pipeline and stage, the attacker can retrieve status information for jobs in pipelines they are not authorized to view. The attacker may need to guess valid job IDs; these are server-assigned and may follow a predictable pattern (e.g., sequential integers) or be discoverable through other means.

3. Payload/Execution Method: The attack is a direct API call. No special payload is required beyond crafting the request parameters. The attacker iterates over possible job IDs, possibly automating the process, and collects the responses.

4. Post-Exploitation Impact: The attacker gains knowledge of internal pipeline structures, job names, agent IP addresses and UUIDs, and progress timestamps. This information can be used to map the CI/CD environment, identify high-value pipelines, and plan further attacks, such as targeting specific agents or pipelines for supply chain compromise. However, the immediate impact is limited to information disclosure; no direct code execution or data modification is possible through this vulnerability alone.

Impact Assessment

The CVSS score is 4.3 (Medium), with the following subscores:

• Attack Vector: Network (AV:N) — the vulnerability is exploitable remotely over the network.
• Attack Complexity: Low (AC:L) — no special conditions are required.
• Privileges Required: Low (PR:L) — the attacker must have valid credentials for any user account.
• User Interaction: None (UI:N) — no victim interaction is needed.
• Scope: Unchanged (S:U) — the vulnerability does not affect other components.
• Confidentiality: Low (C:L) — limited information disclosure, excluding sensitive data like console output or artifacts.
• Integrity: None (I:N) — no data modification.
• Availability: None (A:N) — no denial of service.

The blast radius is confined to the GoCD instance. The information disclosed can aid in further attacks, such as targeting specific agents or pipelines, but does not directly lead to compromise. Affected systems are GoCD servers with versions prior to 26.1.0. The vulnerability is not known to be exploited in the wild, and no public exploit code exists.

Detection Guidance

Sigma Rule

title: GoCD JobStatus Authorization Bypass
id: 8f9a2b1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2026-52743 by accessing jobStatus.json with mismatched pipeline/stage and job ID.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: gocd
detection:
  selection:
    cs-method: GET
    cs-uri-stem: '/jobStatus.json'
    cs-uri-query|contains:
      - 'pipelineName='
      - 'stageName='
      - 'jobId='
  condition: selection
falsepositives:
  - Legitimate users accessing their own job statuses
level: medium

YARA Rule

rule CVE_2026_52743_GoCD_JobStatus_Exploit
{
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2026-52743 in GoCD"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52743"
    strings:
        $endpoint = "/jobStatus.json"
        $param1 = "pipelineName="
        $param2 = "stageName="
        $param3 = "jobId="
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52743 GoCD JobStatus Authorization Bypass Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/jobStatus.json"; http_uri; content:"pipelineName="; http_uri; content:"stageName="; http_uri; content:"jobId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic Detection

sequence by user.name
  [network where http.request.method == "GET" and url.path == "/jobStatus.json" and url.query contains "pipelineName="]
  [network where http.request.method == "GET" and url.path == "/jobStatus.json" and url.query contains "stageName=" and url.query contains "jobId="]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri="/jobStatus.json*" uri_query="*pipelineName=*" uri_query="*stageName=*" uri_query="*jobId=*"
| stats count by src_ip, user, uri_query
| where count > 10

Wazuh OSSEC Rule

<group name="gocd,web,">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/jobStatus.json</url>
    <match>pipelineName=</match>
    <match>stageName=</match>
    <match>jobId=</match>
    <description>CVE-2026-52743: GoCD JobStatus authorization bypass attempt detected.</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the GoCD server to trusted users and networks only.
   • Enforce strong authentication and least privilege for all GoCD accounts.
   • Monitor access logs for unusual patterns of /jobStatus.json requests, especially with mismatched pipeline/stage/job ID combinations.
   • If feasible, disable or restrict the internal /jobStatus.json API for non-administrative users until a patch can be applied.

2. Patch/Upgrade Steps:

   • Upgrade GoCD to version 26.1.0 or later. The fix is included in that release.
   • Verify the upgrade by checking the GoCD version in the web UI or via the API.
   • After upgrading, retest the endpoint to ensure the authorization check is enforced.

3. Long-Term Hardening:

   • Implement role-based access control (RBAC) with granular permissions for pipelines and stages.
   • Regularly audit and review user permissions.
   • Use a Web Application Firewall (WAF) to detect and block enumeration attempts against sensitive endpoints.
   • Keep GoCD and all CI/CD components up to date with security patches.
   • Conduct periodic security assessments of CI/CD infrastructure.

References

1. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52743
2. GoCD Release Notes for 26.1.0 (vendor advisory): https://www.gocd.org/releases/
3. CWE-639: Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
4. CISA KEV: Not applicable (CVE-2026-52743 is not listed in KEV as of this report).
5. MITRE ATT&CK T1213: Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at this time.